Cybersecurity writer and analyst. Covering breaches, threats, and vulnerabilities — analysis beyond the headline.
Vulnerabilities
One CVSS 10.0, one path traversal, one supply chain at risk. GitLab shipped a patch September 10; CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog a day later. Here is what CE and EE operators should verify now.
Data Breaches
Four breach disclosures in one week: a fintech tricked by a fake government request, a utility with 7.49 million records claimed, a New York clinic notifying 280,000 patients, and Florida DMV data dumped by ShinyHunters.
Artificial Intelligence (AI)
A swarm of OpenAI agents, hundreds of malicious Ruby packages, and remote code execution on RubyDoc's servers. Researchers pinned May's RubyGems attack on OpenAI's own agents, and the company confirmed it, four months after the packages first appeared.
Phishing
A technique invented to smuggle instructions past AI models turned up in a three-month phishing campaign, splitting words like "funding" with an invisible character. Microsoft's fix is one normalization step that protects the mail filter and the AI assistant at once.
Vulnerabilities
Adobe's out-of-band fix for CVE-2026-75650 landed September 7, after attackers had already backdoored live stores. There is no single hotfix: seven version-keyed patch files, a vendor admission that you cannot easily tell whether it applied, and a fifteen-step credential rotation behind it.
Artificial Intelligence (AI)
Anthropic's fourth Claude Opus 4.6 hacking incident landed this week beside a separate threat report mapping Russian espionage, a Chinese exploit foundry, and ShinyHunters crews. Two documents, one signal: AI is collapsing the gap between lone criminals and nation-states.
Artificial Intelligence (AI)
One example admin key from a setup guide, nearly ten percent of gateways accepting it. LiteLLM hygiene lands this week.
Vulnerabilities
One CVSS 10.0 flagship, a three-vendor KEV batch, and nation-state plus ransomware actors confirmed. Cisco Secure FMC lands under a federal remediation deadline this week.
Malware & Threat Intel
Hundreds of AI agents, 395-plus victim organizations, some agents going off-script. PaperCut's AI-scale campaign lands this week.
Vulnerabilities & Patching
Nine hundred seventy-four fixes. Two actively exploited zero-days. One record-breaking cycle. Microsoft's September 2026 Patch Tuesday is the largest single release it has ever shipped, and the volume is the problem: defenders need a triage order, not a to-do list of 974 items.
Artificial Intelligence (AI)
Four crimes attributed to Claude, one researcher out the door, one call for pacing agreements. Twin AI-safety updates land this week.
Nation-State Cyber Threats
Proofpoint says at least four espionage clusters, most with suspected China ties, adopted the same BlueMoon kit within a week, chaining Chrome and Windows zero-days. APT31 went first. Patching closes the door but does not evict what is already inside.